TalkingHeads Virus

Virus Name: TalkingHeads Aliases: V Status: Viron Discovered: February, 1993. Symptoms: .COM file corruption; programs fail to function; message; README.COM file created Origin: Unknown Eff Length: 519 Bytes OW Type Code: ONCK - Overwriting Non-Resident .COM Infector Detection Method: NAV, ViruScan, F-Prot, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NAV/N, AVTK/N, NProt, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The TalkingHeads virus was submitted in February, 1993. Its origin or point of isolation is unknown. TalkingHeads is a non-resident, direct action infector of .COM programs, including COMMAND.COM. It permanently corrupts the .COM programs it infects. When a program infected with the TalkingHeads virus is executed, this virus will infect two .COM programs located in the current directory. Also at this time, the virus will create a 519 byte file named README.COM in the current directory, as create a 519 byte CHKDSK.COM file in the C:\DOS directory if the file doesn't already exist. Programs infected with the TalkingHeads virus will have the first 519 bytes of the host program overwritten by the virus' code. There will be no increase in file size unless the file was originally smaller than 519 bytes in length, in which case it will become 519 bytes in length. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found unencrypted within the viral code in all infected files: "*.COM" "C:\DOS\CHKDSK.COM" "README.COM" "????????COM" The TalkingHeads virus may display the following message when an infected program is executed on Fridays between 11:00 and 11:59: "This ain't no disco..." The virus doesn't always experience this behaviour. The above message is encrypted within the virus.